BackABOUT

Privacy Policy

Last updated: April 6, 2026

1. Data Controller

StrikeMap is operated from Switzerland. For the purposes of the Swiss Federal Act on Data Protection (FADP), the EU General Data Protection Regulation (GDPR), and the UK GDPR, the data controller is:

StrikeMap
Zurich, Switzerland
team@strikemap.live

We have not appointed a Data Protection Officer as we are a small-scale operation. For all privacy-related inquiries, contact us at the email above.

2. What We Collect

We collect the minimum data necessary to operate the Platform. This includes:

  • Account information — If you register, we collect your email address, display name, and authentication credentials (including Google OAuth tokens if you choose to sign in with Google). We do not require your real name.
  • Profile data — Country code (optional), avatar image, display preferences, and subscription tier.
  • Payment information — If you subscribe to a paid tier, payment processing is handled entirely by Stripe. We store your Stripe customer ID and subscription status but never receive or store your credit card number, bank details, or other payment instrument details.
  • Chat data — Messages you post in public chat, including message content, timestamps, and any media attachments. If you use chat without an account, a randomly generated guest identifier is stored in your browser's local storage.
  • Push notification subscriptions — If you opt in to browser notifications, we store a push endpoint URL, encryption keys, and an optional device label. No additional device data is collected.
  • User-submitted content — Reports, intelligence contributions, or media submitted by vetted contributors are stored and attributed to your account.
  • Usage analytics — We collect anonymized data about pages visited, features used, and general navigation patterns. This data is not linked to your identity.
  • IP addresses — Logged for security purposes (abuse prevention, rate limiting). IP addresses are not associated with your account profile and are deleted with server logs after 90 days.
  • Cookies and local storage — Used to maintain your session, remember your preferences (theme, map settings), and support authentication. See Section 8 for details.

3. Legal Basis for Processing

We process your personal data on the following legal bases under the GDPR and Swiss FADP:

  • Performance of a contract (Art. 6(1)(b) GDPR) — Processing necessary to provide the Platform to you: account management, authentication, subscription services, and chat functionality.
  • Legitimate interest (Art. 6(1)(f) GDPR) — Security monitoring, abuse prevention, rate limiting, anonymized analytics, and the operation of a public interest information platform covering armed conflict. Our legitimate interest in providing accurate, real-time conflict intelligence has been balanced against individual privacy rights.
  • Consent (Art. 6(1)(a) GDPR) — Push notification subscriptions and optional analytics cookies. You can withdraw consent at any time by disabling notifications in your browser or adjusting cookie settings.
  • Legal obligation (Art. 6(1)(c) GDPR) — Where we are required to retain data or disclose information to comply with applicable law.

4. How We Use Your Data

We use collected data to:

  • Provide, maintain, and improve the Platform and its features.
  • Authenticate your identity and maintain your session.
  • Process subscription payments and manage your account tier.
  • Deliver push notifications you have opted into.
  • Enforce our Terms of Service, moderate chat, and protect against abuse.
  • Analyze aggregate usage patterns to guide development priorities. We do not use your personal data for advertising, profiling, or sale to third parties.
  • Communicate with you about your account, security issues, or material changes to our policies.

5. AI and Automated Processing

StrikeMap uses artificial intelligence to process intelligence data from third-party sources (Telegram messages, news reports, government alerts). AI enrichment extracts structured information such as locations, weapon types, and damage assessments from these external sources.

AI processing is not applied to your personal data. No automated decisions with legal or similarly significant effects are made about you based on your personal data. Moderation decisions (chat bans, content removal) are made or reviewed by human operators.

6. Third-Party Services and Sub-Processors

We use the following third-party services to operate the Platform. Each processes data on our behalf under contractual obligations to protect your information:

  • Supabase (USA) — Database hosting, user authentication, real-time messaging infrastructure, and file storage (avatars, media). Processes account data, chat messages, and push notification subscriptions.
  • Stripe (USA) — Payment processing for subscriptions. Receives payment details you provide directly to Stripe. We only receive your Stripe customer ID and subscription status.
  • Google (USA) — Gemini AI — Used for AI enrichment of third-party intelligence data (not your personal data). Also used as an optional OAuth sign-in provider.
  • Upstash (USA/EU) — Redis-based rate limiting infrastructure. Processes anonymized request metadata (IP hashes, request counts) to prevent abuse.
  • MapTiler (EU) — Optional satellite map imagery tiles. Map tile requests are sent directly from your browser to MapTiler and may include your IP address.

We do not sell, rent, or trade your personal data to any third party. We do not share your data with advertisers.

7. International Data Transfers

Some of our sub-processors are located in the United States. Where personal data is transferred outside Switzerland or the EEA, we rely on the following safeguards:

  • EU-US Data Privacy Framework — For transfers to US-based processors that are certified under the framework (Stripe, Google).
  • Standard Contractual Clauses (SCCs) — For transfers to processors not covered by an adequacy decision, we use EU Commission-approved SCCs as the transfer mechanism.
  • Swiss adequacy recognition — Switzerland recognizes the adequacy of EEA/UK data protection. The Swiss Federal Data Protection and Information Commissioner (FDPIC) maintains a list of countries with adequate protection.

You can request a copy of the relevant transfer safeguards by contacting us at team@strikemap.live.

8. Cookies and Local Storage

StrikeMap uses the following types of cookies and browser storage:

  • Essential cookies — Required for authentication, session management, and basic Platform functionality. These cannot be disabled without breaking core features. Legal basis: contract performance.
  • Preference storage — Theme selection (light/dark), map preferences, and UI state stored in cookies and browser local storage. Guest chat identifiers are stored in local storage. Legal basis: legitimate interest.
  • Analytics cookies — Collect anonymized usage data. These do not track you across other websites. Legal basis: consent.

We do not use advertising cookies, cross-site tracking pixels, or fingerprinting techniques. Your browser settings can be configured to block or delete cookies, though this may affect Platform functionality.

8. Data Sharing

We may disclose your personal data only in the following circumstances:

  • With your consent — When you explicitly authorize sharing.
  • Legal obligation — When required by Swiss law, court order, or regulatory request from a competent Swiss authority, or by mandatory foreign legal process recognized under Swiss law.
  • Safety — When necessary to protect the safety of our users, the public, or the integrity of the Platform.
  • Aggregated and anonymized data — We may share aggregate statistics about Platform usage that cannot be used to identify any individual.

10. Your Rights

Under the Swiss FADP, the EU/UK GDPR, and applicable data protection law, you have the following rights:

  • Right of access — Request a copy of all personal data we hold about you.
  • Right to rectification — Request correction of inaccurate or incomplete personal data.
  • Right to erasure — Request deletion of your personal data, subject to legal retention requirements and the limitations described in our Data Retention Policy.
  • Right to data portability — Request your data in a structured, machine-readable format (JSON) for transfer to another service.
  • Right to restrict processing — Request that we limit how we process your data while a complaint or correction is pending.
  • Right to object — Object to processing based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds.
  • Right to withdraw consent — Where processing is based on consent (push notifications, analytics cookies), you can withdraw at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at team@strikemap.live. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with:

  • Switzerland — The Federal Data Protection and Information Commissioner (FDPIC), edoeb.admin.ch
  • EU/EEA — Your local data protection supervisory authority.
  • UK — The Information Commissioner's Office (ICO).

11. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this policy. For detailed information about retention periods for each category of data, see our Data Retention Policy.

12. Children's Privacy

StrikeMap is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children. If we become aware that a user is under 16, we will promptly delete their account and associated data.

If you believe a child under 16 has created an account, please contact us at team@strikemap.live.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be indicated by updating the “Last updated” date at the top of this page. For significant changes, we will notify registered users via email or platform notification. We will seek fresh consent where changes affect processing based on your consent.

14. Contact

For privacy-related questions, data requests, or to exercise your rights under the FADP or GDPR, contact us at team@strikemap.live.